Behavioral task
behavioral1
Sample
D677F86403915B15AB62B1278CC7E6A8F2A98DE2BA6A8.exe
Resource
win7-20220812-en
General
-
Target
D677F86403915B15AB62B1278CC7E6A8F2A98DE2BA6A8.exe
-
Size
804KB
-
MD5
2389e42ff51d5ad1f896a23cf8aa846e
-
SHA1
a04d40e9ff1b51b0fd606b57dbe17d737c6b08c7
-
SHA256
d677f86403915b15ab62b1278cc7e6a8f2a98de2ba6a84ee67e06c1ffd696bc1
-
SHA512
27054d642ce4be6791ce49f317628371052c0992d02129cbc07128e3f1f3338631d71226b5428a713104735daedccd5c9f5aea6e17161447a9b05bb8b42d5c10
-
SSDEEP
24576:U/fprVmqZKA9JgLLK8ltKTrk/9efaTh6QAJ:GhMwcToQAJ
Malware Config
Signatures
-
Privateloader family
Files
-
D677F86403915B15AB62B1278CC7E6A8F2A98DE2BA6A8.exe.exe windows x86
9f58a58de21293c406e08477ed0abc56
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
FindClose
lstrcatA
GetModuleHandleA
MultiByteToWideChar
Sleep
GlobalAlloc
lstrcpyA
VerSetConditionMask
GetModuleHandleW
WideCharToMultiByte
VerifyVersionInfoW
GetSystemTimeAsFileTime
GetComputerNameA
GetProcAddress
HeapFree
lstrlenA
HeapAlloc
lstrcpynA
GetProcessHeap
GetLastError
CreateFileW
CreateFileA
InitializeSListHead
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
FormatMessageW
CreateDirectoryW
DeleteFileW
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
SetLastError
SetFilePointer
QueryPerformanceFrequency
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
DecodePointer
GetCPInfo
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCurrentThread
GetThreadTimes
InterlockedPushEntrySList
RaiseException
RtlUnwind
FreeLibrary
LoadLibraryExW
GetFileType
ExitProcess
GetModuleHandleExW
SetEnvironmentVariableA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
WriteConsoleW
GetACP
GetConsoleMode
ReadConsoleW
GetConsoleCP
SetStdHandle
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
HeapReAlloc
OutputDebugStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
WriteFile
ReadFile
SetEvent
ResetEvent
WaitForSingleObjectEx
user32
CharToOemA
CharNextA
advapi32
CryptGenRandom
CryptAcquireContextA
CryptReleaseContext
ConvertSidToStringSidA
LookupAccountNameA
Sections
.text Size: 571KB - Virtual size: 571KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 139KB - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ